SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   KDE Konqueror Vendors:   KDE.org
(Gentoo Issues Fix) KDE Konqueror Lets Remote Users Inject Content into Open Windows
SecurityTracker Alert ID:  1012618
SecurityTracker URL:  http://securitytracker.com/id/1012618
CVE Reference:   CVE-2004-1158   (Links to External Site)
Date:  Dec 19 2004
Impact:   Modification of system information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.2.2
Description:   A vulnerability was reported in KDE Konqueror. A remote user can inject content into an open window in certain cases to spoof web site contents.

Secunia Research reported that if the target name of an open window is known, a remote user can create Javascript that, when loaded by the target user, will display arbitrary content in the opened window. A remote user can exploit this to spoof the content of potentially trusted web sites.

A demonstration exploit test is available at:

http://secunia.com/multiple_browsers_window_injection_vulnerability_test/

The vendor was notified on November 19, 2004.

Impact:   A remote user can inject arbitrary content into an open window in certain cases to spoof web site contents.
Solution:   Gentoo has released a fix and indicates that all kdelibs users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdelibs-3.2.3-r4"

All kdebase users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdebase-3.2.3-r3"

Vendor URL:  www.kde.org/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Gentoo)

Message History:   This archive entry is a follow-up to the message listed below.
Dec 8 2004 KDE Konqueror Lets Remote Users Inject Content into Open Windows



 Source Message Contents

Subject:  [gentoo-announce] [ GLSA 200412-16 ] kdelibs, kdebase: Multiple vulnerabilities


--nextPart1438587.vJ6iSbSvzF
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200412-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: kdelibs, kdebase: Multiple vulnerabilities
      Date: December 19, 2004
      Bugs: #72804, #73869
        ID: 200412-16

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

kdelibs and kdebase contain a flaw allowing password disclosure when
creating a link to a remote file. Furthermore Konqueror is vulnerable
to window injection.

Background
==========

KDE is a feature-rich graphical desktop environment for Linux and
Unix-like Operating Systems. The KDE core libraries (kdebase and
kdelibs) provide native support for many protocols. Konqueror is the
KDE web browser and filemanager.

Affected packages
=================

    -------------------------------------------------------------------
     Package           /  Vulnerable  /                     Unaffected
    -------------------------------------------------------------------
  1  kde-base/kdelibs     < 3.3.2-r1                      *>= 3.2.3-r4
                                                          *>= 3.3.1-r2
                                                           >= 3.3.2-r1
  2  kde-base/kdebase     < 3.3.2-r1                      *>= 3.2.3-r3
                                                          *>= 3.3.1-r2
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

Daniel Fabian discovered that the KDE core libraries contain a flaw
allowing password disclosure by making a link to a remote file. When
creating this link, the resulting URL contains authentication
credentials used to access the remote file (CAN 2004-1171).

The Konqueror webbrowser allows websites to load webpages into a window
or tab currently used by another website (CAN-2004-1158).

Impact
======

A malicious user could have access to the authentication credentials of
other users depending on the file permissions.

A malicious website could use the window injection vulnerability to
load content in a window apparently belonging to another website.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All kdelibs users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=kde-base/kdelibs-3.2.3-r4"

All kdebase users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=kde-base/kdebase-3.2.3-r3"

References
==========

  [ 1 ] KDE Security Advisory: plain text password exposure
        http://www.kde.org/info/security/advisory-20041209-1.txt
  [ 2 ] CAN 2004-1171
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1171
  [ 3 ] KDE Security Advisory: Konqueror Window Injection Vulnerability
        http://www.kde.org/info/security/advisory-20041213-1.txt
  [ 4 ] CAN 2004-1158
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1158

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200412-16.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2004 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

--nextPart1438587.vJ6iSbSvzF
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)

iD8DBQBBxZI8zKC5hMHO6rkRAvFpAJ9nfunQfwwvI7ymGaM7C6/3G8ewvgCfS89h
mczUtTenHOyoBZWPtoRs4OI=
=MzR9
-----END PGP SIGNATURE-----

--nextPart1438587.vJ6iSbSvzF--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC